The situation describes a scenario where a customer ' s personal information was shared with third parties without explicit consent, leading to unsolicited offers. This indicates a control weakness in data privacy and confidentiality, specifically the undue disclosure of information to external parties.
(A) Incorrect - Excessive collecting of information.
While collecting too much personal data can be a privacy concern, the issue here is not about data collection but how the data was shared.
(B) Incorrect - Application of social engineering.
Social engineering refers to deceptive tactics used to manipulate individuals into disclosing confidential information, which is not the case here.
(C) Incorrect - Retention of incomplete information.
The issue is not about missing or incomplete data but rather unauthorized sharing of data.
(D) Correct - Undue disclosure of information.
The retailer improperly shared the customer ' s personal data with other businesses, leading to unsolicited offers.
This represents a failure to comply with data privacy regulations (e.g., GDPR, CCPA).
IIA's GTAG (Global Technology Audit Guide) - Data Privacy Risks and Controls Highlights the risks associated with unauthorized data sharing.
NIST Cybersecurity Framework - Data Protection and Privacy
Emphasizes the importance of controlling access to customer information.
COSO's ERM Framework - Information Governance and Compliance
Discusses the importance of data protection policies to prevent undue disclosure Analysis of Answer Choices:IIA References and Internal Auditing Standards:

A record is a complete set of related fields about one entity or transaction. In this case, the spreadsheet line contains several related fields-employee name, date of hire, job title, and monthly salary-about one employee. Each individual item, such as the employee's name or monthly salary, is a field. A file is a collection of records, such as the entire employee spreadsheet. A database is a structured collection of related data files or tables that can be managed and queried. Internal auditors using data analytics must understand these concepts because field selection, record completeness, duplicates, and data structure affect testing accuracy. Since the full line represents one employee's related data elements, Option C is correct.

According to the International Standards for the Professional Practice of Internal Auditing, when significant risk exposures remain unaddressed after a follow-up engagement, the CAE must first discuss the matter with the appropriate level of management responsible for the area. The purpose is to determine whether there is a valid reason for not implementing the recommended corrective actions, to clarify management's perspective, and to encourage timely resolution.
If management still refuses to act and the risk remains high, the CAE must then escalate the issue to senior management and, if necessary, to the board. Immediate escalation to the board without first discussing with management is inappropriate, as it bypasses the chain of accountability. Reporting directly to external auditors is also not the responsibility of the CAE unless specifically mandated by regulation or law.
Therefore, the correct initial step is to discuss the issue with management responsible for the risk area (Option B).
Reference:IIA Standards - Standard 2500: Monitoring Progress; Implementation Guide 2500 - Monitoring Progress.

The first step in pricing is to develop pricing objectives. Management must decide what the price is intended to achieve, such as profit maximization, market penetration, market skimming, survival, target return, market share growth, or product positioning. Once objectives are clear, the organization can assess demand, estimate costs, analyze competitors, select a pricing method, and set the final price. Determining product cost is important, but cost alone does not define the pricing strategy. Competitor prices must be evaluated, but only after the organization understands its own pricing purpose and market position. Selecting a pricing method is also premature until objectives, demand, cost, and competition have been considered. Internal auditors reviewing pricing controls should test whether pricing decisions align with approved strategy. Therefore, Option B is correct.

Reference: IIA Business Knowledge for Internal Auditing, Data Analytics in Auditing section.